import { test } from 'node:test';
import assert from 'node:assert/strict';
import { hasFeaturePermission, isActingInOwnScope } from '@/services/shared/access';
import { ROLE_NAMES, ROLE_SCOPES } from '@/shared/constants/roles';
import type { CurrentUser } from '@/db/api/types';

function permission(name: string) {
  return { name };
}

function user(overrides: Partial<CurrentUser>): CurrentUser {
  return {
    id: 'user-1',
    app_role: { name: ROLE_NAMES.TEACHER, globalAccess: false },
    ...overrides,
  };
}

test('hasFeaturePermission allows a per-user custom grant', () => {
  assert.equal(
    hasFeaturePermission(
      user({ custom_permissions: [permission('MANAGE_FRAME')] }),
      'MANAGE_FRAME',
    ),
    true,
  );
});

test('hasFeaturePermission allows a loaded role permission', () => {
  assert.equal(
    hasFeaturePermission(
      user({
        app_role: {
          name: ROLE_NAMES.TEACHER,
          globalAccess: false,
          permissions: [permission('MANAGE_FRAME')],
        },
      }),
      'MANAGE_FRAME',
    ),
    true,
  );
});

test('hasFeaturePermission does not grant feature access from role name alone', () => {
  assert.equal(
    hasFeaturePermission(
      user({ app_role: { name: ROLE_NAMES.DIRECTOR, globalAccess: false } }),
      'MANAGE_FRAME',
    ),
    false,
  );
});

test('hasFeaturePermission lets per-user exclusion override a role-granted permission', () => {
  assert.equal(
    hasFeaturePermission(
      user({
        app_role: {
          name: ROLE_NAMES.DIRECTOR,
          globalAccess: false,
          permissions: [permission('MANAGE_FRAME')],
        },
        custom_permissions_filter: [permission('MANAGE_FRAME')],
      }),
      'MANAGE_FRAME',
    ),
    false,
  );
});

test('hasFeaturePermission does not let globalAccess imply explicit personal workflow permissions', () => {
  assert.equal(
    hasFeaturePermission(
      user({ app_role: { name: ROLE_NAMES.SUPER_ADMIN, globalAccess: true } }),
      'READ_PARENT_COMM',
    ),
    false,
  );
  assert.equal(
    hasFeaturePermission(
      user({
        app_role: { name: ROLE_NAMES.SUPER_ADMIN, globalAccess: true },
        custom_permissions: [permission('READ_PARENT_COMM')],
      }),
      'READ_PARENT_COMM',
    ),
    true,
  );
});

test('hasFeaturePermission does not let system_admin global scope imply permissions without grants', () => {
  assert.equal(
    hasFeaturePermission(
      user({ app_role: { name: ROLE_NAMES.SYSTEM_ADMIN, globalAccess: true } }),
      'MANAGE_FRAME',
    ),
    false,
  );
  assert.equal(
    hasFeaturePermission(
      user({
        app_role: {
          name: ROLE_NAMES.SYSTEM_ADMIN,
          globalAccess: true,
          permissions: [permission('MANAGE_FRAME')],
        },
      }),
      'MANAGE_FRAME',
    ),
    true,
  );
});

test('isActingInOwnScope allows a user without drilled scope', () => {
  assert.equal(
    isActingInOwnScope(user({
      organizationId: 'org-1',
      app_role: {
        name: ROLE_NAMES.SUPERINTENDENT,
        scope: ROLE_SCOPES.ORGANIZATION,
        globalAccess: false,
      },
    })),
    true,
  );
});

test('isActingInOwnScope allows an active scope matching the user own scope', () => {
  assert.equal(
    isActingInOwnScope(user({
      organizationId: 'org-1',
      schoolId: 'school-1',
      app_role: {
        name: ROLE_NAMES.PRINCIPAL,
        scope: ROLE_SCOPES.SCHOOL,
        globalAccess: false,
      },
      activeScope: {
        level: 'school',
        organizationId: 'org-1',
        schoolId: 'school-1',
        campusId: null,
        classId: null,
      },
    })),
    true,
  );
});

test('isActingInOwnScope rejects parent user drilled into a child scope', () => {
  assert.equal(
    isActingInOwnScope(user({
      organizationId: 'org-1',
      app_role: {
        name: ROLE_NAMES.SUPERINTENDENT,
        scope: ROLE_SCOPES.ORGANIZATION,
        globalAccess: false,
      },
      activeScope: {
        level: 'school',
        organizationId: 'org-1',
        schoolId: 'school-1',
        campusId: null,
        classId: null,
      },
    })),
    false,
  );
});

test('isActingInOwnScope rejects organization users drilled into another organization', () => {
  assert.equal(
    isActingInOwnScope(user({
      organizationId: 'org-1',
      app_role: {
        name: ROLE_NAMES.SUPERINTENDENT,
        scope: ROLE_SCOPES.ORGANIZATION,
        globalAccess: false,
      },
      activeScope: {
        level: 'organization',
        organizationId: 'org-2',
        schoolId: null,
        campusId: null,
        classId: null,
      },
    })),
    false,
  );
});

test('isActingInOwnScope rejects global access user drilled into a tenant', () => {
  assert.equal(
    isActingInOwnScope(user({
      app_role: {
        name: ROLE_NAMES.SUPER_ADMIN,
        scope: ROLE_SCOPES.SYSTEM,
        globalAccess: true,
      },
      activeScope: {
        level: 'organization',
        organizationId: 'org-1',
        schoolId: null,
        campusId: null,
        classId: null,
      },
    })),
    false,
  );
});
